Skip to content

test: certify fleet Actions and SOPS secrets - #43

Closed
ORESoftware wants to merge 1 commit into
mainfrom
agent/fleet-secret-canary
Closed

ORESoftware wants to merge 1 commit into
mainfrom
agent/fleet-secret-canary

Conversation

@ORESoftware

@ORESoftware ORESoftware commented Aug 11, 2026 •

Copy link
Copy Markdown
Contributor

Canary completed successfully — closed without merge

Run 31529217690 certified the production secret path end to end:

  • ZED_FLEET_GH_TOKEN exists and has push access to zed-pkg/zed-clients
  • SOPS_AGE_KEY decrypts env/enc/prod.env.enc
  • env/dec is mode 0700; env/dec/prod.env is mode 0600
  • .env is the managed relative symlink to env/dec/prod.env
  • the decrypted value exactly matches the direct Actions secret
  • ores-sops verify and ores-sops lock pass
  • Python GitHub discovery works under actions/setup-python with normal certificate and hostname verification
  • the full nightly clients-fleet workflow was dispatched with apply=false

The subsequent dry run discovered 30 *-clients repositories and 128 consumer repositories across 113 visible organizations. This PR was disposable and is intentionally closed without merge.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant